@openparachute/vault 0.6.5-rc.12 → 0.6.5-rc.9

package/src/cli.ts

@@ -152,20 +152,8 @@ import {
   resolveTranscribeCppPaths,
   resolveTranscriptionProviderName,
   transcribeCppInstalled,
-  probeTranscribeCliRunnable,
   readManifest,
-  transcriptionHomeDir,
-  pythonVenvDir,
-  pythonManifestPath,
-  readPythonManifest,
-  resolveParakeetMlxBin,
-  resolveParakeetMlxModel,
-  resolveOnnxAsrBin,
-  resolveOnnxAsrModel,
-  parakeetMlxInstalled,
-  onnxAsrInstalled,
   type TranscribeCppManifest,
-  type PythonInstallManifest,
 } from "./transcription/select.ts";
 import {
   buildTranscribeCli,
@@ -174,14 +162,6 @@ import {
   TRANSCRIBE_CPP_SOURCE_REF,
   type CliBuildResult,
 } from "./transcription/build.ts";
-import { downloadTo } from "./transcription/download.ts";
-import { selectDefaultProvider, NOMINAL_SLACK_GB, type TierPlan } from "./transcription/tiers.ts";
-import {
-  PYTHON_PROVIDERS,
-  buildDefaultPythonDeps,
-  installPythonBackend,
-  type PythonProviderName,
-} from "./transcription/install-python.ts";
 
 // ---------------------------------------------------------------------------
 // Argument parsing
@@ -3549,23 +3529,17 @@ function printHistoryUsage(): void {
 // ---------------------------------------------------------------------------
 
 /**
- * `parachute-vault transcription install` — set up a LOCAL transcription
- * provider. With no `--provider`, the ratified RAM/arch/OS tier table
- * (scribe-fold Phase 2b, `tiers.ts`) picks the host's default:
- *
- *   - macOS Apple Silicon 8GB+ → parakeet-mlx (Python venv, MLX)
- *   - Linux 4GB+               → onnx-asr (Python venv, int8 ONNX)
- *   - Linux ~2GB               → transcribe-cpp + small whisper GGUF
- *   - ~1GB / below floor       → remote steer (scribe-http), never forced
- *
- * The pick + footprint is printed and the operator confirms (or overrides
- * with `--provider`/`--model`). Every path is idempotent + non-fatal, and
- * activation is HONEST: `TRANSCRIPTION_PROVIDER` flips only when a runnable
- * binary actually exists (PRs #532/#533 precedent). `--dry-run`/`--plan`
- * prints the selection without downloading.
+ * `parachute-vault transcription install` — set up the local `transcribe-cpp`
+ * provider: detect OS/arch + RAM, pick a tier-appropriate GGUF model
+ * (scribe#82 fix — Parakeet floored to ≥4GB), download the prebuilt
+ * transcribe-cli release asset + the model into
+ * `~/.parachute/transcription/`, and switch `TRANSCRIPTION_PROVIDER` in the
+ * vault `.env`. Idempotent (skips already-present files unless `--force`),
+ * non-fatal. `--dry-run`/`--plan` prints the selection without downloading —
+ * the path tests exercise (no network).
  *
  * `parachute-vault transcription status` — show the configured provider +
- * per-provider install state.
+ * install state.
  */
 async function cmdTranscription(args: string[]) {
   const sub = args[0];
@@ -3574,13 +3548,11 @@ async function cmdTranscription(args: string[]) {
     return;
   }
   if (sub === "status" || sub === undefined) {
-    await cmdTranscriptionStatus();
+    cmdTranscriptionStatus();
     return;
   }
   console.error(`Unknown transcription subcommand: ${sub}`);
-  console.error(
-    "Usage: parachute-vault transcription install [--dry-run] [--model <id>] [--provider <transcribe-cpp|parakeet-mlx|onnx-asr|scribe-http>]",
-  );
+  console.error("Usage: parachute-vault transcription install [--dry-run] [--model <id>] [--provider <name>]");
   console.error("       parachute-vault transcription status");
   process.exit(1);
 }
@@ -3604,9 +3576,9 @@ async function cmdTranscriptionInstall(args: string[]) {
   const force = args.includes("--force");
   const yes = args.includes("--yes") || args.includes("-y");
   const overrideModel = takeArgValue(args, "--model").value;
-  const providerArg = takeArgValue(args, "--provider").value;
+  const provider = takeArgValue(args, "--provider").value ?? "transcribe-cpp";
 
-  if (providerArg === "scribe-http") {
+  if (provider === "scribe-http") {
     // Just flip config back to the remote provider — no download.
     if (dryRun) {
       console.log("Would set TRANSCRIPTION_PROVIDER=scribe-http in the vault .env (remote provider; no download).");
@@ -3616,162 +3588,11 @@ async function cmdTranscriptionInstall(args: string[]) {
     console.log("Set TRANSCRIPTION_PROVIDER=scribe-http. Restart vault to apply. (Remote provider — no local binary/model needed.)");
     return;
   }
-
-  let provider: string;
-  let tierModel: string | undefined;
-  if (providerArg) {
-    if (!["transcribe-cpp", "parakeet-mlx", "onnx-asr"].includes(providerArg)) {
-      console.error(
-        `Unknown --provider "${providerArg}". Valid: transcribe-cpp, parakeet-mlx, onnx-asr, scribe-http.`,
-      );
-      process.exit(1);
-    }
-    provider = providerArg;
-  } else {
-    // Auto-default: the ratified RAM/arch/OS tier table (tiers.ts). Probe the
-    // host, print the pick + footprint; the operator confirms below (or
-    // re-runs with --provider/--model to override).
-    const tier = selectDefaultProvider({
-      platform: process.platform,
-      arch: process.arch,
-      totalRamBytes: detectTotalRamBytes(),
-    });
-    printTierPick(tier);
-    if (tier.provider === "scribe-http") {
-      // Remote steer — never force a local install on a below-tier box.
-      console.log("\nNo local install performed. To point at a remote provider now:");
-      console.log("  parachute-vault transcription install --provider scribe-http");
-      if (tier.localOptIn) {
-        console.log(`\nLocal opt-in (explicit only — not auto-installed): ${tier.localOptIn.note}`);
-      }
-      process.exit(dryRun ? 0 : 1);
-    }
-    provider = tier.provider;
-    tierModel = tier.model;
-    console.log("");
-  }
-
-  if (provider === "transcribe-cpp") {
-    // The tier's model pick (e.g. the Linux ~2GB whisper-small tier) seeds the
-    // transcribe-cpp flow; an explicit --model always wins.
-    await runTranscribeCppInstall({ dryRun, force, yes, overrideModel: overrideModel ?? tierModel });
-    return;
-  }
-  await runPythonProviderInstall(provider as PythonProviderName, {
-    dryRun,
-    force,
-    yes,
-    overrideModel,
-  });
-}
-
-/** Print the tier-table pick for this host (the install auto-default). */
-function printTierPick(tier: TierPlan): void {
-  console.log(`Host: ${tier.platform}/${tier.arch}, ${tier.totalRamGb}GB RAM`);
-  console.log(`Tier default: ${tier.provider}${tier.model ? ` (${tier.model})` : ""}`);
-  console.log(`  ${tier.reason}`);
-  if (tier.approxDiskMb) {
-    console.log(`  ~${tier.approxDiskMb}MB download${tier.peakRamNote ? `, ${tier.peakRamNote}` : ""}`);
-  }
-  console.log("  (override with --provider <transcribe-cpp|parakeet-mlx|onnx-asr|scribe-http>)");
-}
-
-/**
- * Install a Python-based local provider (parakeet-mlx / onnx-asr) into the
- * managed venv under `~/.parachute/transcription/venv/` and — honestly —
- * activate it only when a runnable binary verified (`install-python.ts` owns
- * the apt/venv/warm-pull steps; activation + manifest stay here, mirroring
- * the transcribe-cpp flow).
- */
-async function runPythonProviderInstall(
-  provider: PythonProviderName,
-  opts: { dryRun: boolean; force: boolean; yes: boolean; overrideModel?: string },
-): Promise<void> {
-  const spec = PYTHON_PROVIDERS[provider];
-  const venv = pythonVenvDir();
-  // `--model` wins; else env/manifest/ratified default. The pick lands in the
-  // install manifest, which the runtime model resolution reads back.
-  const model =
-    opts.overrideModel ??
-    (provider === "parakeet-mlx" ? resolveParakeetMlxModel() : resolveOnnxAsrModel());
-  const totalRamGb = Math.round((detectTotalRamBytes() / 2 ** 30) * 10) / 10;
-
-  console.log(`Transcription install plan (${provider} — local, Python venv):\n`);
-  console.log(`Host:    ${process.platform}/${process.arch}, ${totalRamGb}GB RAM`);
-  console.log(`Package: ${spec.pipTarget} → ${venv}`);
-  console.log(`Model:   ${model}`);
-  console.log(`         ~${spec.approxDiskMb}MB model download, ${spec.peakRamNote}`);
-
-  if (opts.dryRun) {
-    // Preview the guards the real run would hit — pure, no side effects.
-    if (spec.platform && spec.platform !== process.platform) {
-      console.log(`\n  Refused: ${provider} only runs on ${spec.platform}; this host is ${process.platform}.`);
-    } else if (spec.arch && spec.arch !== process.arch) {
-      console.log(`\n  Refused: ${provider} needs ${spec.arch} (Apple Silicon); this host is ${process.arch}.`);
-    } else if (totalRamGb < spec.minRamGb - NOMINAL_SLACK_GB && !opts.force) {
-      console.log(`\n  Refused: ${totalRamGb}GB RAM < the ~${spec.minRamGb}GB ${provider} floor. ${spec.ramFloorRationale}`);
-    }
-    console.log("\n(--dry-run) Nothing installed.");
-    return;
-  }
-
-  if (!opts.yes) {
-    const ok = await confirm(
-      `Install ${spec.pipTarget} into ${venv} (model ~${spec.approxDiskMb}MB ${provider === "parakeet-mlx" ? "downloads on first use" : "warm-pulled now"})?`,
-      true,
-    );
-    if (!ok) {
-      console.log("Aborted.");
-      return;
-    }
-  }
-
-  const outcome = await installPythonBackend(buildDefaultPythonDeps(), {
-    provider,
-    force: opts.force,
-    model,
-  });
-
-  if (!outcome.ok || !outcome.binPath) {
-    console.error(`\n✗ ${outcome.summary}`);
-    console.error(
-      "Your current provider is unchanged — the verb is idempotent; fix the issue and re-run. Or use the remote provider: parachute-vault transcription install --provider scribe-http",
-    );
+  if (provider !== "transcribe-cpp") {
+    console.error(`Unknown --provider "${provider}". Valid: transcribe-cpp, scribe-http.`);
     process.exit(1);
   }
 
-  // Manifest + honest activation (a runnable binary exists — verified above).
-  const manifest: PythonInstallManifest = {
-    provider,
-    pipTarget: spec.pipTarget,
-    bin: outcome.binPath,
-    venv: outcome.venv ?? "",
-    model,
-    os: process.platform,
-    arch: process.arch,
-    ram_gb: totalRamGb,
-    installedAt: new Date().toISOString(),
-  };
-  mkdirSync(transcriptionHomeDir(), { recursive: true });
-  writeFileSync(pythonManifestPath(), JSON.stringify(manifest, null, 2));
-
-  setEnvVar("TRANSCRIPTION_PROVIDER", provider);
-  console.log(`\n✓ Installed and activated → TRANSCRIPTION_PROVIDER=${provider} set in the vault .env.`);
-  console.log(`  Binary: ${outcome.binPath}`);
-  console.log(`  Model:  ${model}`);
-  if (provider === "parakeet-mlx") {
-    console.log(`  NOTE: the model (~${spec.approxDiskMb}MB) downloads into the HuggingFace cache on the first transcription.`);
-  }
-  console.log(`  Restart vault to activate:  parachute restart vault`);
-}
-
-async function runTranscribeCppInstall(opts: {
-  dryRun: boolean;
-  force: boolean;
-  yes: boolean;
-  overrideModel?: string;
-}) {
-  const { dryRun, force, yes, overrideModel } = opts;
   const plan = planInstall({
     platform: process.platform,
     arch: process.arch,
@@ -3869,25 +3690,14 @@ async function runTranscribeCppInstall(opts: {
 
     // 5) CLI resolution + provider switch — honest, no silent success. `binPath`
     //    resolves to TRANSCRIBE_CPP_BIN or the built binary; we activate
-    //    transcribe-cpp only when one actually EXECUTES (`--help` exits 0 —
-    //    vault#534: an existsSync-only check activated Linux installs whose CLI
-    //    exited 1 on every run). Otherwise we keep the current provider and
-    //    report the gap rather than taking transcription offline behind a
-    //    provider that can't run.
+    //    transcribe-cpp only when one actually exists, else we keep the current
+    //    provider and report the acquisition gap rather than taking
+    //    transcription offline behind a provider that can't run.
     if (existsSync(paths.binPath)) {
-      const probe = await probeTranscribeCliRunnable(paths.binPath);
-      if (probe.ok) {
-        setEnvVar("TRANSCRIPTION_PROVIDER", "transcribe-cpp");
-        console.log(`\n✓ Installed and activated → TRANSCRIPTION_PROVIDER=transcribe-cpp set in the vault .env.`);
-        console.log(`  CLI:   ${paths.binPath} (verified runnable)`);
-        console.log(`  Restart vault to activate:  parachute restart vault`);
-      } else {
-        console.log(
-          `\n⚠  transcribe-cli exists at ${paths.binPath} but is NOT runnable (${probe.reason}).`,
-        );
-        console.log("   NOT activating transcribe-cpp — your current provider is unchanged.");
-        console.log(noRunnableCliGuidance(paths, buildResult));
-      }
+      setEnvVar("TRANSCRIPTION_PROVIDER", "transcribe-cpp");
+      console.log(`\n✓ Installed and activated → TRANSCRIPTION_PROVIDER=transcribe-cpp set in the vault .env.`);
+      console.log(`  CLI:   ${paths.binPath}`);
+      console.log(`  Restart vault to activate:  parachute restart vault`);
     } else {
       console.log(`\n✓ Libraries + model installed to ${paths.dir} — transcription is NOT yet activated.`);
       console.log(noRunnableCliGuidance(paths, buildResult));
@@ -3899,6 +3709,13 @@ async function runTranscribeCppInstall(opts: {
   }
 }
 
+/** Download a URL to a destination file (streamed via fetch → Bun.write). */
+async function downloadTo(url: string, dest: string): Promise<void> {
+  const resp = await fetch(url, { redirect: "follow" });
+  if (!resp.ok) throw new Error(`download failed (${resp.status}) for ${url}`);
+  await Bun.write(dest, resp);
+}
+
 /**
  * Download the release tarball, extract it, and place its runtime shared
  * libraries (libtranscribe + libggml `.dylib`/`.so`) into `paths.libsDir`,
@@ -3990,8 +3807,6 @@ async function maybeBuildTranscribeCli(
           await downloadTo(cliSourceUrl(rel), dest);
         }
       },
-      readFile: (p) => readFileSync(p, "utf8"),
-      writeFile: (p, content) => writeFileSync(p, content),
       compile: (cmd) => {
         const p = Bun.spawnSync(cmd);
         return { exitCode: p.exitCode ?? 1, stderr: new TextDecoder().decode(p.stderr) };
@@ -4040,14 +3855,6 @@ function noRunnableCliGuidance(
       "     • build transcribe-cli yourself, point TRANSCRIBE_CPP_BIN at it, and re-run; OR",
       "     • use the remote provider:  parachute-vault transcription install --provider scribe-http",
     );
-  } else if (build && !build.ok && build.stage === "patch") {
-    lines.push(
-      `\n⚠  Could not apply the vault#534 backend-init source patch — ${build.message}`,
-      "   The pinned upstream source no longer matches the patch anchor. This needs a code fix",
-      "   (re-anchor or drop the patch), not a toolchain fix. Until then, either:",
-      "     • build a transcribe-cli yourself, point TRANSCRIBE_CPP_BIN at it, and re-run; OR",
-      "     • use the remote provider:  parachute-vault transcription install --provider scribe-http",
-    );
   } else if (build && !build.ok) {
     lines.push(
       `\n⚠  transcribe-cli build failed (${build.stage}). The libraries + model are installed;`,
@@ -4070,39 +3877,15 @@ function noRunnableCliGuidance(
   return lines.join("\n");
 }
 
-/** `parachute-vault transcription status` — provider + per-provider install state. */
-async function cmdTranscriptionStatus(): Promise<void> {
+/** `parachute-vault transcription status` — provider + install state. */
+function cmdTranscriptionStatus(): void {
   const active = resolveTranscriptionProviderName();
   console.log(`Configured provider: ${active}`);
-
-  // What the ratified tier table would pick for this host (install default).
-  const tier = selectDefaultProvider({
-    platform: process.platform,
-    arch: process.arch,
-    totalRamBytes: detectTotalRamBytes(),
-  });
-  console.log(
-    `Tier default for this host (${tier.platform}/${tier.arch}, ${tier.totalRamGb}GB): ${tier.provider}${tier.model ? ` (${tier.model})` : ""}`,
-  );
-
-  // transcribe-cpp — prebuilt libs + GGUF model + built CLI. "runnable" is an
-  // EXECUTED verdict, not a stat: `--help` must actually exit 0 (vault#534 —
-  // an existsSync-only check said "yes" on Linux while the CLI exited 1 on
-  // every real transcription because its dlopen'd CPU backends never loaded).
   const paths = resolveTranscribeCppPaths();
   const manifest = readManifest(paths.manifestPath);
   const cliPresent = existsSync(paths.binPath);
-  const filesPresent = transcribeCppInstalled(paths); // CLI + model both on disk
-  let installed = false;
-  let notRunnableReason: string | undefined;
-  if (!filesPresent) {
-    notRunnableReason = !cliPresent ? "no transcribe-cli binary" : "no GGUF model on disk";
-  } else {
-    const probe = await probeTranscribeCliRunnable(paths.binPath);
-    installed = probe.ok;
-    notRunnableReason = probe.reason;
-  }
-  console.log(`\ntranscribe-cpp runnable: ${installed ? "yes" : `no (${notRunnableReason})`}`);
+  const installed = transcribeCppInstalled(paths); // runnable CLI + model both present
+  console.log(`transcribe-cpp runnable: ${installed ? "yes" : "no"}`);
   if (manifest) {
     console.log(`  model:   ${manifest.model} (${manifest.modelFile})`);
     console.log(
@@ -4115,56 +3898,14 @@ async function cmdTranscriptionStatus(): Promise<void> {
     );
     console.log(`  ram:     ${manifest.ram_gb}GB at install (${manifest.os}/${manifest.arch})`);
   } else {
-    console.log(`  (not installed — run: parachute-vault transcription install --provider transcribe-cpp)`);
+    console.log(`  (nothing installed — run: parachute-vault transcription install)`);
   }
-
-  // parakeet-mlx / onnx-asr — Python venv providers (scribe-fold Phase 2b).
-  const pyManifest = readPythonManifest(pythonManifestPath());
-  const pkBin = resolveParakeetMlxBin();
-  const pkRunnable = parakeetMlxInstalled();
-  console.log(`\nparakeet-mlx runnable: ${pkRunnable ? "yes" : "no"}`);
-  if (pkRunnable) {
-    console.log(`  bin:     ${pkBin}`);
-    console.log(`  model:   ${resolveParakeetMlxModel()} (HF cache; downloads on first use)`);
-  } else {
+  if (active === "transcribe-cpp" && !installed) {
     console.log(
-      process.platform === "darwin" && process.arch === "arm64"
-        ? `  (not installed — run: parachute-vault transcription install${tier.provider === "parakeet-mlx" ? "" : " --provider parakeet-mlx"})`
-        : "  (macOS Apple Silicon only)",
+      "\n⚠  provider is transcribe-cpp but no runnable transcribe-cli is installed — transcription is offline until a CLI is available (TRANSCRIBE_CPP_BIN, or a build from source).",
     );
   }
-
-  const oxBin = resolveOnnxAsrBin();
-  const oxRunnable = onnxAsrInstalled();
-  console.log(`onnx-asr runnable: ${oxRunnable ? "yes" : "no"}`);
-  if (oxRunnable) {
-    console.log(`  bin:     ${oxBin}`);
-    console.log(`  model:   ${resolveOnnxAsrModel()} (HF cache)`);
-  } else {
-    console.log(
-      `  (not installed — run: parachute-vault transcription install${tier.provider === "onnx-asr" ? "" : " --provider onnx-asr"})`,
-    );
-  }
-  if (pyManifest) {
-    console.log(
-      `  python install: ${pyManifest.provider} (${pyManifest.pipTarget}) @ ${pyManifest.installedAt}${pyManifest.venv ? ` — venv ${pyManifest.venv}` : ""}`,
-    );
-  }
-
-  // Offline warning when the ACTIVE provider isn't runnable.
-  const activeRunnable =
-    active === "scribe-http" ||
-    (active === "transcribe-cpp" && installed) ||
-    (active === "parakeet-mlx" && pkRunnable) ||
-    (active === "onnx-asr" && oxRunnable);
-  if (!activeRunnable) {
-    console.log(
-      `\n⚠  provider is ${active} but no runnable ${active} install was found — transcription is offline until one is available (\`parachute-vault transcription install\`).`,
-    );
-  }
-  console.log(
-    `\nAvailable transcribe-cpp models (override with --model): ${Object.values(MODELS).map((m: ModelChoice) => m.name).join(", ")}`,
-  );
+  console.log(`\nAvailable models (override with --model): ${Object.values(MODELS).map((m: ModelChoice) => m.name).join(", ")}`);
 }
 
 // ---------------------------------------------------------------------------
@@ -5075,27 +4816,22 @@ Schema maintenance:
 
 Transcription (scribe-fold):
   parachute-vault transcription install [--dry-run] [--model <id>] [--force] [--yes]
-                                           Install this host's tier-default LOCAL provider (probes
-                                           OS/arch + RAM, prints the pick + footprint, confirms):
-                                             macOS Apple Silicon 8GB+ → parakeet-mlx (Python venv, MLX)
-                                             Linux 4GB+               → onnx-asr (Python venv, int8 ONNX)
-                                             Linux ~2GB               → transcribe-cpp + small whisper GGUF
-                                             ~1GB / below floor       → remote steer (never forced)
-                                           Activation is honest: TRANSCRIPTION_PROVIDER flips only when
-                                           a runnable binary exists. Idempotent; --dry-run prints the
-                                           pick without downloading; --force re-downloads / bypasses the
-                                           RAM floor on an explicit --provider; --yes skips the confirm.
-  parachute-vault transcription install --provider <name>
-                                           Override the tier default. transcribe-cpp downloads the
-                                           runtime libs + a GGUF (--model overrides the RAM-tier pick:
-                                           whisper-tiny.en | whisper-small.en | parakeet-tdt-0.6b-v3;
-                                           builds transcribe-cli from source — needs a C++ compiler).
-                                           parakeet-mlx / onnx-asr install a Python venv under
-                                           ~/.parachute/transcription/venv (needs python3; apt-installs
-                                           python3/ffmpeg on Linux). scribe-http switches back to the
-                                           remote provider (no download).
-  parachute-vault transcription status     Show the configured provider, this host's tier default, and
-                                           per-provider install state.
+                                           Install the local transcribe-cpp provider — detects
+                                           OS/arch + RAM, downloads the transcribe.cpp runtime
+                                           libraries + a RAM-tier-appropriate GGUF model into
+                                           ~/.parachute/transcription/. NOTE: v0.1.1 ships a library,
+                                           not a CLI — it activates (sets
+                                           TRANSCRIPTION_PROVIDER=transcribe-cpp) only when a runnable
+                                           transcribe-cli is available (TRANSCRIBE_CPP_BIN or a build
+                                           from source), else it reports the gap. --dry-run prints the
+                                           pick + footprint without downloading. --model overrides the
+                                           RAM-tier choice (whisper-tiny.en | whisper-small.en |
+                                           parakeet-tdt-0.6b-v3). --force re-downloads; --yes skips the
+                                           confirm. Needs ffmpeg on PATH to transcode audio to 16kHz
+                                           mono WAV (hinted if missing).
+  parachute-vault transcription install --provider scribe-http
+                                           Switch back to the remote scribe-http provider (no download).
+  parachute-vault transcription status     Show the configured provider + local install state.
 
 ── Advanced / standalone ──────────────────────────────────────────────
 

package/src/export-watch.ts

@@ -10,7 +10,7 @@
  * cursor captured at the *start* of the previous cycle. Vault writes are
  * HTTP-mediated and don't surface to filesystem watchers (the bun:sqlite DB
  * is opaque), so polling on `updated_at >= cursor` is the simplest robust
- * detection. See `docs/contracts/vault-portable-export.md`.
+ * detection. See `parachute-patterns/cookbook/vault-portable-export.md`.
  */
 
 import { ensureGitAvailable } from "./git-preflight.ts";

package/src/routes.ts

@@ -2089,7 +2089,7 @@ export async function handleTags(
 
   // PUT /tags/:name — upsert tag identity row. Body accepts any combination
   // of { description, fields, relationships, parent_names }; omitted keys
-  // are preserved, explicit null clears. See docs/contracts/tag-data-model.md.
+  // are preserved, explicit null clears. See patterns/tag-data-model.md.
   if (req.method === "PUT") {
     // Canonical-bare-tag guard (vault#XXX): normalize the upserted tag NAME so
     // the existing-field merge read (store.getTagSchema below) and the upsert
@@ -2114,7 +2114,7 @@ export async function handleTags(
        * the MCP `update-tag` tool relies on (omitted keys preserved). The
        * Schema editor (vault#283) sends the full map + `replace_fields: true`
        * so removing a field row actually deletes the field. See
-       * docs/contracts/tag-data-model.md.
+       * patterns/tag-data-model.md.
        */
       replace_fields?: unknown;
     };
@@ -2211,7 +2211,7 @@ export async function handleTags(
     // Tag-scoped tokens reference root tags by name; deleting a referenced
     // tag would silently orphan the token's allowlist. Fail closed (409)
     // and name the offending tokens so the operator can revoke or re-mint
-    // before retrying. docs/contracts/tag-scoped-tokens.md §Dependencies.
+    // before retrying. patterns/tag-scoped-tokens.md §Dependencies.
     const referenced_by = findTokensReferencingTag(store.db, tagName);
     if (referenced_by.length > 0) {
       return json(

package/src/routing.test.ts

@@ -1631,7 +1631,7 @@ describe("scope enforcement on /api/*", () => {
     expect(res.status).toBe(401);
   });
 
-  // ----- tag-scoped tokens (docs/contracts/tag-scoped-tokens.md) -----------------
+  // ----- tag-scoped tokens (patterns/tag-scoped-tokens.md) -----------------
 
   /**
    * Mint a tag-scoped token. Mirrors `mintToken` above but threads
@@ -1745,7 +1745,7 @@ describe("scope enforcement on /api/*", () => {
   });
 
   // ----- Q6: orphan-sub-tag fail-open ------------------------------------
-  // docs/contracts/tag-scoped-tokens.md §Storage: when a sub-tag has no declared
+  // patterns/tag-scoped-tokens.md §Storage: when a sub-tag has no declared
   // schema, the string-form root authorizes. Token allowlisted for `health`
   // must see `#health/food` even when no `_tags/health/food` schema exists.
 

package/src/routing.ts

@@ -856,7 +856,7 @@ export async function route(
 
   const apiPath = apiMatch[1] ?? "";
 
-  // Tag-scoped tokens (docs/contracts/tag-scoped-tokens.md): expand the token's
+  // Tag-scoped tokens (patterns/tag-scoped-tokens.md): expand the token's
   // root-tag allowlist into `{root} ∪ descendants(root)` once per request,
   // so handlers can intersect against the note's tag set without re-walking
   // the `_tags/<name>` hierarchy on every check. `tagScope.allowed` is null

package/src/server.ts

@@ -31,18 +31,10 @@ import { assetsDir } from "./routes.ts";
 import { resolveScribeAuthToken, ensureScribeBearer } from "./scribe-env.ts";
 import { getCachedScribeUrl } from "./scribe-discovery.ts";
 import { TranscribeCppProvider } from "./transcription/providers/transcribe-cpp.ts";
-import { ParakeetMlxProvider } from "./transcription/providers/parakeet-mlx.ts";
-import { OnnxAsrProvider } from "./transcription/providers/onnx-asr.ts";
 import {
   resolveTranscriptionProviderName,
   resolveTranscribeCppPaths,
   transcribeCppInstalled,
-  resolveParakeetMlxBin,
-  resolveParakeetMlxModel,
-  resolveOnnxAsrBin,
-  resolveOnnxAsrModel,
-  parakeetMlxInstalled,
-  onnxAsrInstalled,
 } from "./transcription/select.ts";
 import { readEnvFile, setEnvVar } from "./config.ts";
 import { resolveBindHostname } from "./bind.ts";
@@ -166,29 +158,6 @@ if (providerName === "transcribe-cpp") {
       "[transcribe] TRANSCRIPTION_PROVIDER=transcribe-cpp but no runnable transcribe-cli + model installed — see `parachute-vault transcription status` (v0.1.1 ships a library, not a CLI; set TRANSCRIBE_CPP_BIN or build one)",
     );
   }
-} else if (providerName === "parakeet-mlx" || providerName === "onnx-asr") {
-  // Python-based local providers (scribe-fold Phase 2b): subprocess the
-  // parakeet-mlx / onnx-asr CLI. Only start the worker when a runnable binary
-  // resolves (env override → managed venv → PATH) — otherwise every pending
-  // item would terminal-fail with `missing_provider`. Cheap existsSync check
-  // (no spawn), matching the providers' `available()`.
-  const installed = providerName === "parakeet-mlx" ? parakeetMlxInstalled() : onnxAsrInstalled();
-  if (installed) {
-    const provider =
-      providerName === "parakeet-mlx"
-        ? new ParakeetMlxProvider({
-            binPath: resolveParakeetMlxBin(),
-            model: resolveParakeetMlxModel(),
-          })
-        : new OnnxAsrProvider({ binPath: resolveOnnxAsrBin(), model: resolveOnnxAsrModel() });
-    transcriptionWorker = startTranscriptionWorker({ ...commonWorkerOpts, provider });
-    wireTranscriptionWorker(transcriptionWorker);
-    console.log(`[transcribe] worker started → ${providerName}`);
-  } else {
-    console.log(
-      `[transcribe] TRANSCRIPTION_PROVIDER=${providerName} but no runnable ${providerName} binary found — run \`parachute-vault transcription install\` (see \`transcription status\`)`,
-    );
-  }
 } else {
   // Default scribe-http path — behavior-preserving (Phase 1). Start the worker
   // if scribe is discoverable; otherwise transcription is a no-op.

package/src/tag-scope.ts

@@ -1,12 +1,12 @@
 /**
- * Tag-scope enforcement for tag-scoped tokens (docs/contracts/tag-scoped-tokens.md).
+ * Tag-scope enforcement for tag-scoped tokens (patterns/tag-scoped-tokens.md).
  *
  * A token's `scoped_tags` allowlist narrows its effective access to notes
  * carrying one of the allowlisted tags or a sub-tag thereof. The expansion
  * to descendants happens via the per-vault `_tags/<name>` config-note
  * hierarchy (see core/src/tag-hierarchy.ts).
  *
- * Auth check pseudocode (from docs/contracts/tag-scoped-tokens.md):
+ * Auth check pseudocode (from patterns/tag-scoped-tokens.md):
  *
  *   if (!hasScope(token, ...)) return forbidden();
  *   if (token.scoped_tags === null) return ok();   // unscoped
@@ -38,7 +38,7 @@ export async function expandTokenTagScope(
 
 /**
  * Return true iff the note's tag set intersects the expanded allowlist OR
- * — fail-open per docs/contracts/tag-scoped-tokens.md §Storage — any of the
+ * — fail-open per patterns/tag-scoped-tokens.md §Storage — any of the
  * note's tags has a string-form root inside `rawRoots`. The string-form
  * fallback covers the orphan-sub-tag case: a token allowlisted for
  * `health` should still see `#health/food` even when no `_tags/health/food`

package/src/token-store.ts

@@ -54,7 +54,7 @@ export interface Token {
    * access is the intersection of `scopes` and notes carrying one of these
    * tags or a sub-tag thereof (hierarchy expansion via getTagDescendants).
    * NULL = unscoped, full vault access per `scopes`. See
-   * docs/contracts/tag-scoped-tokens.md.
+   * patterns/tag-scoped-tokens.md.
    */
   scoped_tags: string[] | null;
   /**
@@ -301,7 +301,7 @@ export function markMcpMintLedgerRevoked(
  * Returns display ID + label pairs (no token-hash exposure) so error
  * envelopes can name the offending tokens for the operator. The match is
  * exact on the root name — `scoped_tags` only ever stores roots per
- * docs/contracts/tag-scoped-tokens.md.
+ * patterns/tag-scoped-tokens.md.
  */
 export function findTokensReferencingTag(
   db: Database,